OpenProject SQL Injection Vulnerability in Cost Reporting Module

A SQL injection vulnerability has been identified in OpenProject versions prior to 17.2.3. The issue arises in the cost reporting module, where the '=n' operator embeds user input directly into SQL WHERE clauses without proper parameterization. This flaw allows authenticated users with access to cost reports to read or modify any database data.

Impact

Exploitation of this vulnerability allows authenticated users with access to cost reports to read or modify any database data.

Remediation

Users are advised to update to OpenProject version 17.2.3 or later.